Hot answers tagged

13

There are a number of things that could be causing this - unfortunately, we probably need a bit more information. Before I get into my actual response, just a quick point on your HTML pages: generally speaking, the application pool can only respond to a certain number of requests at a time. If it is busy responding to requests for dynamic pages, then it may ...


9

Passive FTP requires that the FTP server have ports opened to it from the external network. Azure VM's use NAT, and thus needs extra configuration in order to support passive FTP. The (rough) checklist: Set the external VIP in the IIS FTP manager Set the port range to use (you might wanna show some moderation here - configuring thousands of ports are not ...


8

It's not SHA causing the problem, it's TLS 1.0. The SSL Labs report for your domain gives the full story. Your server only supports TLS 1.0, not 1.1 or 1.2. In addition, it still supports obsolete ciphers like RC4, and doesnt support perfect forward secrecy. Tuning IIS to get better security is quite possible, but a pain to do by hand. This wonderful ...


7

The recommended way to do this is to have a custom health probe in your load balanced set. For example, you could have a simple healthcheck.html page on each of your VM's (in wwwroot for example) and direct the probe from your load balanced set to this page. As long as the probe can retrieve that page (HTTP 200), the Azure load balancer will keep sending ...


6

Http/2 requirements as per https://http2.github.io/http2-spec/#rfc.section.9.2.2 : 9.2.2 TLS 1.2 Cipher Suites A deployment of HTTP/2 over TLS 1.2 SHOULD NOT use any of the cipher suites that are listed in the cipher suite black list (Appendix A). Endpoints MAY choose to generate a connection error (Section 5.4.1) of type INADEQUATE_SECURITY if ...


5

Joseph's answer makes perfect sense, but it doesn't seem to work. The attribute 'serverAutoStart' on the site node in applicationHost.config is not changed. One way to change is: Set-WebConfigurationProperty -pspath 'MACHINE/WEBROOT/APPHOST' -filter "system.applicationHost/sites/site[@name='Default Web Site']" -name "serverAutoStart" -value "False" but ...


5

Set up a 2nd server (such as a virtual machine, or a 2nd daemon on the same host). Use a rewrite rule to reverse proxy requests for something optional to the 2nd server, like an invisible image hidden on the page. Configure the 2nd server to only allow TLS 1.2; don't hotlink to another hostname... make sure to proxy, or it won't be secure so maybe the ...


5

In this example, StartSSL is your certificate provider. While logged into StartSSL, use the "Certificate Wizard" to submit your certificate signing request (CSR). You must have already validated your domain with them, which is to say, you went through the Validations Wizard and they've established that you have sufficient ownership of a domain to be ...


5

This is seems to be covered fairly well in install.txt included in the PHP zip downloads. Quoting from that file ... Manual Installation Steps ... Upgrading from a previous PHP version: Previous editions of the manual suggest moving various ini and DLL files into your SYSTEM (i.e. C:\WINDOWS) folder and while this simplifies ...


4

Basing on @jgillich answer, I propose to do the following: netsh http add urlacl url=http://+:80/ sddl=D:(A;;GX;;;S-1-1-0) sddl argument will be virtually the same as user, but you don't need to think of a localized group name. So, it's more universal.


4

It seems that you are actually asking how to change HTTP ports in IIS. Open Internet Information Services (IIS) Manager (from Administrative tools) Connections pane: COMPUTER NAME Sites Default Web Site Actions pane: Edit Site Bindings... Just select the binding http->80 and edit it to meet your requirements. Repeat for any other sites bind ...


4

Having read around this some more I have come to the following conclusions; The DH parameters Microsoft used in TLS_DHE_RSA_WITH_AES_128_GCM / TLS_DHE_RSA_WITH_AES_256_GCM are, for compatibility reasons, only 1024 bits in length and are thus considered 'weak'. The new cipher suites continue to not be present in the default cipher suite priority due to ...


4

You can use Microsoft's log parser utility. It has the capability of dumping into a SQL database as well as having the ability to create a checkpoint file so that it only imports records it hasn't processed. It can be used either as a stand alone executable or programmatically invoked via an ActiveX control


4

There being a CNAME record rather than a direct address record (A/AAAA) is not a factor. The certificate verification is based on the hostname in the location URL. For navigating to https://example.com/ to work, you would need a certificate that is valid for example.com. Ie, a certificate that either has example.com as the Subject CN (Common Name) or that ...


3

Yes it's possible to do this. The technology you are looking for is called Name Based Virtual Hosting.


3

First, MX records are not SRV records. Second, he's absolutely right. I deal with this issue quite often with one of my clients that also hosts Exchange for their clients. Outlook needs to find autodiscover information that points to the Exchange server. The problem with having a wildcard record is that it causes autodiscover.domain.com to resolve to your ...


3

The value of a second CPU depends entirely on your load. In the case of a typical small business web server, a dual CPU system will likely not give you any performance increase. For a database - well, it really depends on the database and your query types and load. A typical website won't make much use of the CPU. Think of a DUAL CPU server as a server ...


3

Two-parter: Yes. First step is identity of the receiving process, so you'll need to use a common identity for the service on both (which functionally means a domain user account, or better, a GMSA.) That'll let you interchangeably connect to either server by name (assuming an SPN is registered for each) but you did mention agnosticism towards which server ...


3

Since you don't intend to use this website externally, and you have a domain, you therefore have an internal certificate authority (CA). You should be able to create a signing request to send to your internal CA that will give you what you need for SSL.


3

I'm extremely skeptical about these results. While IIS may be faster, both posts do not mention anything specific about the hardware, OS settings(filesystem mount options, io schedulers, network buffers, tcp stakck setting and so on), web server config. Modern http servers are extremely complex animals, you can turn on and off huge amount of options, ...


3

You will want a load balancer in front of both. You can use apache load balancer (alb) serving on port 80. Setup IIS and apache web server on higher ports. Have the load balancer act as fail over not true load balancing. So alb listens on port 80 and any requests get proxied to IIS on a higher port (8181 for example). This way as soon as IIS is down alb will ...


3

Not really knowing what server you are actually looking at we can only guess. Adding to what GregL and Jim B said. My guess is you're migrating from Server 2003 Standard, IIS 6.5, Access 2007 using ASP classic code pages connecting via OLEDB static. You might be planning on importing your Access using Upsizing Wizard (which kind of works most of the ...


3

It should default to the exchange server's name with OWA on the end: https://ExchangeServer/OWA Does that work? If not, try it with your domain as well: https://ExchangeServer.domain.local/OWA


3

For the sake of completeness, and/or to help out the next guy who has this problem and doesn't have his OWA server at the default virtualpath, you can find out through the IIS Manager on the server hosting Outlook Web App. Navigate to the OWA site, check the Advanced Settings to get your OWA Virtual path, and append that to the server name and/or whatever ...


3

The default path, as others have mentioned, is https://servername/OWA. If the default doesn't work, or if you simply want to double-check how the server is actually configured, you can use the Get-OwaVirtualDirectory command in the Exchange Management Shell. Also, here's some documentation about managing Outlook Web App: ...


2

Try to scan for existing short filenames with fsutil: fsutil 8dot3name scan /s /v E:\inetpub\wwwroot And strip them if they are found: fsutil 8dot3name strip /s /v E:\inetpub\wwwroot Also looking at the log with empty magic part (magic part: ""), I wonder could that be a bug in the POC. This line in config.xml looks like it has extra comma after ...


2

There's a good PowerShell script that helps with IIS 7.5 & 8 configuration: This PowerShell script setups your Microsoft Internet Information Server 7.5 and 8.0 (IIS) to support TLS 1.1 and TLS 1.2 protocol with Forward secrecy. Additionally it increases security of your SSL connections by disabling insecure SSL2 and SSL3 and and all insecure ...


2

You can use the Url Rewrite feature of IIS to do that : Open the URL Rewrite feature : Add a rule of type "Request blocking" : Block the requests based on host name : If you know your IP address, you can use it to block requests which use it : Or you can block all requests which are not using the domain name : Hope this helps (It took me ...


2

Take a look in the XML View of the event log ID 29. There you can see OldValue and NewValue change from one state to another OldValue>Starting NewValue>Stopped \?\C:\Windows\system32\inetsrv\config\applicationHost.config MACHINE/WEBROOT/APPHOST /system.applicationHost/sites/site[@name="Default Web Site" and @id="1"]/@state 1 Starting ...



Only top voted, non community-wiki answers of a minimum length are eligible